Add configurable CORS middleware

[vladiant]

Summary

Adds CORS middleware to the FastAPI application so browser-based clients can make cross-origin requests. The middleware is disabled by default (empty origins list) and activated only when IMG_CORS_ORIGINS is set, ensuring zero impact on existing deployments.

Changes

• config.py — Added three new settings: cors_origins, cors_allow_methods, cors_allow_headers (env vars: IMG_CORS_ORIGINS, IMG_CORS_ALLOW_METHODS, IMG_CORS_ALLOW_HEADERS)
• main.py — Conditionally registers CORSMiddleware when cors_origins is non-empty
• README.md / PROJECT_DESCRIPTION.md — Documented new CORS configuration variables
• CHANGELOG.md — Added [2.2.0] release entry
• pyproject.toml — Version bump 2.1.0 → 2.2.0

Configuration

Variable	Default	Description
IMG_CORS_ORIGINS	[]	Allowed origins (e.g. ["http://localhost:3000"]; empty = disabled)
IMG_CORS_ALLOW_METHODS	["GET","POST","PUT","DELETE","OPTIONS"]	Allowed HTTP methods
IMG_CORS_ALLOW_HEADERS	["*"]	Allowed request headers

Usage

# Enable CORS for a local frontend
export IMG_CORS_ORIGINS='["http://localhost:3000"]'

Version bump

MINOR (2.1.0 → 2.2.0) — new backward-compatible feature, no breaking changes.

Checklist

• ruff check — all checks passed
• ruff format — no changes needed
• mypy — no issues found
• pytest — 216/216 tests passed
• CHANGELOG.md updated
• Version bumped in pyproject.toml
• Documentation updated (README, PROJECT_DESCRIPTION)